Finding

`src/routes/(app)/debug/+layout.svelte` guards the `/debug/` route group with a runtime redirect:

```svelte

<script lang=\"ts\"> import { dev } from '\$app/environment' import { goto } from '\$app/navigation' ... if (!dev) { goto(resolve('/')) } </script>

{#if dev}
{@render children()}
{/if}
```

Because the guard is runtime-only (the `dev` flag is a compile-time constant but the file still ships), the production build still bundles:

• `src/routes/(app)/debug/qr/+page.svelte`
• `src/routes/(app)/debug/download/+page.svelte` (352 lines)
• `src/routes/(app)/debug/url/+page.svelte`
• `src/routes/(app)/debug/before-send/+page.svelte`
• `src/routes/(app)/debug/done/+page.svelte`
• `src/routes/(app)/debug/upload/+page.svelte`

Side-effects:

• Extra JS shipped to production users (~hundreds of lines of dev-only UI).
• `console.log('QR test page loaded. PostGuard instance:', pg)` runs on production clients that navigate to `/debug/qr` before the redirect resolves (the script in the page body executes before the parent layout's effect; the layout uses `goto` which is async).
• `robots.txt` already adds `Disallow: /debug`, which acknowledges these routes are reachable in prod.

Suggested fix

Either:

1. Move the guard to build time. In `src/routes/(app)/debug/+layout.ts` (or per-page `+page.ts`), throw 404 in production:

```ts
import { dev } from '$app/environment'
import { error } from '@sveltejs/kit'
export const prerender = false
if (!dev) throw error(404)
```

This prevents the SvelteKit build from emitting these chunks at all when `dev` is statically known false (adapter-static will exclude them).

2. Or, exclude the `debug` directory from the build via Vite `build.rollupOptions.input` filtering, or by moving the debug pages out of `src/routes/` into a separate dev-only entry.

Option 1 is the smallest diff and matches the existing intent.

Files

• `src/routes/(app)/debug/+layout.svelte:1-13`
• `src/routes/(app)/debug/qr/+page.svelte:10` (the `console.log` that runs before the redirect)